Privacy Policy | AceFEExam

Introduction

Welcome to our Privacy Policy. This document explains how we collect, use, and protect your personal information when you use our services.

Information We Collect

We may collect the following types of information:

Personal Information: Name, email address, and contact details you provide when registering or contacting us.
Usage Data: Information about how you interact with our website, including pages visited and time spent.
Device Information: Details about the device you use to access our services, such as IP address, browser type, and operating system.

How We Use Your Information

We use your information for the following purposes:

To provide and maintain our services
To notify you about changes to our services
To send you product news, only if you switch on Product news in Settings (see below)
To provide customer support
To gather analysis or valuable information to improve our services
To monitor the usage of our services
To detect, prevent, and address technical issues

Creating an account does not sign you up for anything. The email we send without asking is the email the service needs: sign-in and verification links, receipts, and — if you book a mock — the reminders for that booking. If you bought a plan, we also warn you before your access ends and check in after your exam date; you can switch those off under Email from us in Settings, and each one carries a one-click unsubscribe link.

Everything else is opt-in and off until you switch it on under Email from us: exam-week reminders, a note when your next free mock is available, and a weekly review digest.

Product news is opt-in too. If you switch on Product news in Settings, your email address is added to our mailing list, which is held by Resend. Switching it off removes you, and every newsletter carries an unsubscribe link that does the same.

Data Security

We implement appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

Third-Party Services

We may employ third-party companies and individuals to facilitate our services, provide services on our behalf, or assist us in analyzing how our services are used.

The services we currently use in this way are Cloudflare (hosting and content delivery), Waffo Pancake (payment processing — card details are handled by them and never reach our servers), Resend (transactional email, and the opt-in mailing list), and the analytics providers named in the next section. Each receives only what it needs to do its job, and none of them is permitted to sell your data or use it for their own advertising.

Analytics, Cookies and Browser Storage

We measure how the site is used so we can tell which parts of it help people pass the exam. We do not run advertising on this site, we do not sell your data, and we do not use it to build advertising profiles.

These scripts run on the live site only — they are not loaded in local development — and they are the complete list:

Plausible Analytics, self-hosted by us at analytics.xhorizon.org. It counts page views and referrers in aggregate, and it is cookieless: it sets no cookie, stores nothing in your browser, and cannot follow you to other sites.
Google Analytics 4 (Google LLC). Aggregate traffic and audience reporting. It sets cookies, listed below.
PostHog (PostHog, Inc., hosted in the United States). Product analytics — for example, how many people who begin the practice diagnostic go on to finish it. It stores an anonymous identifier in your browser, described below.

Cookies we set ourselves

Sign-in session — keeps you logged in and protects the account. Strictly necessary; the site cannot work without it.
Language preference (PARAGLIDE_LOCALE) — remembers the language you chose. Expires after about 13 months.

Cookies and storage set by analytics

Google Analytics sets _ga and _ga_HYMS0M3MZV, which tell one returning browser from another. They expire after up to 13 months.
PostHog sets a ph_phc_…_posthog cookie, expiring after about a year, together with matching entries in your browser's local storage and session storage. These hold a randomly generated, anonymous distinct_id and the state of the current visit.
Plausible sets nothing at all.

The PostHog identifier is what lets us join "started the diagnostic" to "finished it" across separate page loads. It is not connected to your account: we never send PostHog your name, email address or user ID, and the client is configured so that no person profile is ever created against that identifier. Clearing cookies and site data in your browser resets it.

As with any request to a website, these providers also receive your IP address and the general location and device type it implies.

Heatmaps and session recording

Two features of PostHog go further than counting, and we would rather name them than leave them implied:

Heatmaps record where clicks land on a page, so we can see which controls people reach for and which they miss.
Session recording captures a replay of a random 10% sample of visits — navigation, clicks, scrolling and the structure of the pages you saw — so we can find the places where the interface confuses people. Whether a visit is in the sample is decided once and then stays fixed for that browser tab. PostHog masks the contents of form fields, so what you type into them is not part of a replay.

Turning analytics off

You can refuse or delete these cookies in your browser settings, and a tracker-blocking extension or a browser that blocks third-party scripts will stop the analytics above from loading at all. The practice material works either way — only the sign-in cookie is required for the site to function. To be straightforward about it: we do not currently act on "Do Not Track" or Global Privacy Control signals, and neither Google Analytics nor PostHog honours them by default.

If you are in the EEA, the UK or Switzerland, none of the above loads until you have agreed to it: you are shown a consent prompt on your first visit, and Google Analytics, PostHog, heatmaps and session recording stay switched off unless and until you accept. Recording and heatmaps are a separate tick box from ordinary analytics, and it is never ticked for you. Elsewhere, analytics are on by default.

Wherever you are, Cookie settings in the site footer reopens that prompt so you can change or withdraw your answer at any time. Withdrawing deletes the Google Analytics and PostHog cookies and the browser storage already on your device, rather than merely stopping new ones.

See our Cookie Policy for more on cookies generally.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

Your Data Rights

You control the personal information we hold about you.

Access — request a copy of the personal data associated with your account.
Correction — update your display name and avatar yourself in Settings. To change the email address on your account, or correct anything else, email us.
Deletion — delete your account from Settings at any time. Deleting your account removes your profile, attempt history and practice results. We may retain payment and tax records where law requires it.
Portability — request your practice and attempt history in a machine-readable format.
Objection and restriction — ask us to stop or limit a particular use of your data, including marketing email, which you can also switch off from any newsletter we send.

To exercise any of these, email support@acefeexam.com from the address on your account. We respond within 30 days. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

Contact Us

If you have any questions about this Privacy Policy, email us at support@acefeexam.com or use the contact form.